Sign in to follow this  
Followers 0
TomasMascinskas

Damaged Logical Structure of Seagate 7200.11

21 posts in this topic

Hello everyone

using this cable:

Nokia CA-42 DKU-5 USB Cable 3100 5100 6100 6800 7200

http://www.ebay.co.uk/itm/310155366796?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649

this driver: http://www.citronid.com/download/oti_6858_usb_driver.rar

Windows 7 32bit

loopback works, watched and followed the complete guide:

however, if i put the business card in, ctrl + z didnt respond, but it did say connected, so i completed the whole procedure without the business card, last lines were:

F3 T>m0,2,2,0,0,0,0,22 Enter

Max Wr Retries = 00, Max Rd Retries = 00, Max ECC T-Level = 00, Max Certify Rewrite Retries = 0000

User Partition Format 3% complete, Zone 00, Pass 00, LBA 0002F79B, ErrCode 00000080, Elapsed Time 0 mins 30 secs

User Partition Format Successful - Elapsed Time 0 mins 30 secs Zone re-format was skipped.

F3 T>/2

F3 2>Z

Spin Down Complete

Elapsed Time 3.038 msecs

Turn off power from HDD, shutdown your comp.

so i connected the hdd back, but everything was the same for some reason, as i went into my computer, the hdd didnt appear, and in disk management it appeared like this:

20140119_042102aasdas_zps7f23a164.jpg

so i try right clicking on the hdd in disk management > assing letter, say g for example, enter, and it halts disk management, left it for hours and it wouldnt resume, sometimes it comes up in my computer as "Local Disk",

i reboot pc, try running "mini tool power data recovery" the real hdd name comes up "3 documents" but when i click on browse, halts again

hope someone can help me out

so i connected the hdd back, but everything was the same for some reason, as i went into my computer, the hdd didnt appear, and in disk management it appeared like this:

If it was actually "the same as before" it was NOT either BSY or LBA0.

Check in the BIOS ( NOT in the booted Windows).

Is it seen as having zero capacity? If no see below, if yes it means that the de-bricking was not successful and you shoudl try again.

Is it detected? If yes then your procedure worked and the disk is not anymore belongng to this thread, if it is not detected it means that the de-bricking was not successful and you shoudl try again.

If the disk is NOT LBA0 and NOT BSY, then:

hope someone can help me out

Read (attentively) the post just before yours.

Start a NEW thread, you need to recover the partitoning/volume(s).

jaclaz

ok i checked the bios, heres what it looks like:

ASASFSDGF_zps4e689b96.jpg

so from what you say this must be a different issue, i also tried this hdd on ubuntu to see if the drive comes up, but it didnt, and on another windows 7 system, the same as others, just hangs there when you try to enter disk management, if you know about this issue please respond, or if you think i should create a new thread, do you know the name of the problem? any guidance please?

@TomasMascinskas

You have to understand that there are three "levels" when it comes to a disk drive:

  • Real physical level (this is what the BIOS can see and that in your case is OK)
  • Physical level (or RAW device) which is what Disk Management uses to access the device
  • Logical level (what Explorer or other file manager will use ONCE the Disk Manager above will have created a valid logical structure, i.e. partitions/volumes and filesystems on them)
A bricked disk will not be accessed correctly at level #1 above and consequently it won't be available at the other two ones.

An unbricked disk will be accessible at level #1 and at level #2 above but not necessarily at level #3 as, for a number of reasons its logical structure may have been corrupted.

Your disk is detected correctly in the BIOS :yes:, and as such your disk is NOT "bricked" (anymore) :), BUT evidently the logical structure on it has been damaged :(.

Start a NEW thread and we will see if it is possible to repair/recover the logical structure of the disk or if at least file-based recovery is possible.

In more detail, the partitioning of the disk is still OK (your disk management does see a single partition on it) BUT NO valid filesystem is recognised by the Windows and as such a drive letter CANNOT be assigned to it.

jaclaz

0

Share this post


Link to post
Share on other sites

Good, start by providing a copy of the MBR (first absolute sector of the disk).

A suitable tool (for the not-so-avanced user) is HdHacker:

http://dimio.altervista.org/eng/

under Windows 7 you will probably need to run it as Administrator.

Check which disk number the affected disk has in Disk Management (like Disk 0, Disk 1, etc. Disk n)

In Hdhacker you want to select "Physical Drive (MBR)", n, then "First Sector (MBR)", "Number of continuous sectors to read" = 1

Then press button "Read sector from disk"

Then press button "Save sector to file"

Choose a location and filename and save the file.

Then compress it to a zip archive and either attach the .zip to your next post or upload it *somewhere* and provide a link to it.

jaclaz

0

Share this post


Link to post
Share on other sites

Good, start by providing a copy of the MBR (first absolute sector of the disk).

A suitable tool (for the not-so-avanced user) is HdHacker:

http://dimio.altervista.org/eng/

under Windows 7 you will probably need to run it as Administrator.

Check which disk number the affected disk has in Disk Management (like Disk 0, Disk 1, etc. Disk n)

In Hdhacker you want to select "Physical Drive (MBR)", n, then "First Sector (MBR)", "Number of continuous sectors to read" = 1

Then press button "Read sector from disk"

Then press button "Save sector to file"

Choose a location and filename and save the file.

Then compress it to a zip archive and either attach the .zip to your next post or upload it *somewhere* and provide a link to it.

jaclaz

done:

https://www.dropbox.com/s/twmc1n6eakuln0r/MBR_HardDisk0.rar

0

Share this post


Link to post
Share on other sites

Good, the MBR, as expected, is fine (but is important to check it anyway).There is a single entry in it:

Entry Type Boot bCyl bHead bSect eCyl eHead eSec StartSector NumSectors
#0 07 80 0 32 33 1023 254 63 2048 2930272256

which is about a NTFS (or exFAT :unsure:) volume created under Vista :ph34r: or later (beginning on LBA 2048) sized 2,930,272,256 sectors, i.e. 1,500,299,395,072 bytes in size.

Since you cannot access the logicaldrive through an assigned drive letter, you will need to use another approach to get the VBR.

Now it would be about the right time to make either a dd-like image of the disk or to make a clone of it.

You will need a 2 Tb disk to make an image or a 1.5 Tb disk to make a clone.

Get the free version of DMDE:

http://dmde.com/

and follow the instructions here:

http://www.msfn.org/board/topic/170392-how-to-recover-accidentaly-deleted-partitionfiles/page-2#entry1061689

If you decide to not make the image (either because you feel adventurous or because you don't have the money to procure a new disk), you can skip (at your own risk) to the next step, which is, still using the DMDE and the linked above instructions, to save a copy of first (say) 2100 sectors.

I.e. you need to set the Start sector to 0 and the Number of sector to 2100.

What is actually relevant is just the sector LBA 2048 (which is the PBR or VBR, Partition or Volume Boot Record) but having a bunch more sectors may be useful to see if strange forms of corruption happened.

You also want to make a copy of the very last sector of the partition, i.e. sector 2048+2,930,272,256=2,930,274,304 which is the PBR Mirrror, i.e. it should be an exact copy of sector 2048.

Compress the two resulting files into a zip archive and upload them like you did for the MBR.

jaclaz

0

Share this post


Link to post
Share on other sites

Good, the MBR, as expected, is fine (but is important to check it anyway).There is a single entry in it:

Entry Type Boot bCyl bHead bSect eCyl eHead eSec StartSector NumSectors

#0 07 80 0 32 33 1023 254 63 2048 2930272256

which is about a NTFS (or exFAT :unsure:) volume created under Vista :ph34r: or later (beginning on LBA 2048) sized 2,930,272,256 sectors, i.e. 1,500,299,395,072 bytes in size.

Since you cannot access the logicaldrive through an assigned drive letter, you will need to use another approach to get the VBR.

Now it would be about the right time to make either a dd-like image of the disk or to make a clone of it.

You will need a 2 Tb disk to make an image or a 1.5 Tb disk to make a clone.

Get the free version of DMDE:

http://dmde.com/

and follow the instructions here:

http://www.msfn.org/board/topic/170392-how-to-recover-accidentaly-deleted-partitionfiles/page-2#entry1061689

If you decide to not make the image (either because you feel adventurous or because you don't have the money to procure a new disk), you can skip (at your own risk) to the next step, which is, still using the DMDE and the linked above instructions, to save a copy of first (say) 2100 sectors.

I.e. you need to set the Start sector to 0 and the Number of sector to 2100.

What is actually relevant is just the sector LBA 2048 (which is the PBR or VBR, Partition or Volume Boot Record) but having a bunch more sectors may be useful to see if strange forms of corruption happened.

You also want to make a copy of the very last sector of the partition, i.e. sector 2048+2,930,272,256=2,930,274,304 which is the PBR Mirrror, i.e. it should be an exact copy of sector 2048.

Compress the two resulting files into a zip archive and upload them like you did for the MBR.

jaclaz

thank you for being so helpful, but i got an error:

asdasdf_zps0d812525.jpg

0

Share this post


Link to post
Share on other sites

thank you for being so helpful, but i got an error:

Yep. :(

And that error would explain nicely why the filesystem is not recognized.

A "normal" NTFS volume has it's $MFT starting on LCN 786432 with an 8 sectors/cluster that would make 786432*8+2048=6,293,504, the $MFT plays a vital part in filesystem recognizing and access and for the error you got it seems like that sector is in a damaged/bad area.

You can try to see what happens with "ignore all", or decide to "abort".

The next attempt is to try making an image of the disk using a more suitable tool for damaged disks, there is a very good one for Linux (that would make the imaging procedure automatic) and also a more manual Windows one:

http://www.datarescue.com/photorescue/v3/drdd.htm

but then you can try imaging the disk in chunks manually with DMDE, (to get the "advanced" LOG feature in it you need the Professional edition)

If you are familiar enough with Linux (and command line) you can use ddrescue using a log.

A succinct "theory of operation" when imaging manually in "chunks" is provided here:

http://www.msfn.org/board/topic/170288-lost-partition-and-filesystem-problem-with-adata-sh14-disk/?p=1059909

jaclaz

0

Share this post


Link to post
Share on other sites

thank you for being so helpful, but i got an error:

Yep. :(

And that error would explain nicely why the filesystem is not recognized.

A "normal" NTFS volume has it's $MFT starting on LCN 786432 with an 8 sectors/cluster that would make 786432*8+2048=6,293,504, the $MFT plays a vital part in filesystem recognizing and access and for the error you got it seems like that sector is in a damaged/bad area.

You can try to see what happens with "ignore all", or decide to "abort".

The next attempt is to try making an image of the disk using a more suitable tool for damaged disks, there is a very good one for Linux (that would make the imaging procedure automatic) and also a more manual Windows one:

http://www.datarescue.com/photorescue/v3/drdd.htm

but then you can try imaging the disk in chunks manually with DMDE, (to get the "advanced" LOG feature in it you need the Professional edition)

If you are familiar enough with Linux (and command line) you can use ddrescue using a log.

A succinct "theory of operation" when imaging manually in "chunks" is provided here:

http://www.msfn.org/board/topic/170288-lost-partition-and-filesystem-problem-with-adata-sh14-disk/?p=1059909

jaclaz

i used abort all, after a good while it finished, then i done as instructed and went to back up to a file, but its been on 0% for like 4 hours:

asfsdrfhsdtjh_zps3cb2e1ce.jpg

0

Share this post


Link to post
Share on other sites

It seems like you are having several "bad areas".

As said your best option next is ddrescue under Linux, using a Log:

http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html

Usually it can recover as much as it is possible.

What are the temperatures of that disk drive?

It is a good idea to "keep it cool" (like by putting it under the airflow of a fan) when doing intentsive i/o (like imaging/cloning).

jaclaz

0

Share this post


Link to post
Share on other sites

im not sure what the temperature is im afraid

also, i never used linux before, which version do i need please?

will this be fine?

http://www.pendrivelinux.com/linux-live-usb-creator/#more-3034

sorry i just know nothing about linux, once again, thank you so much

and also, in this process, are we backing up the image of the harddrive which is the recovery itself, or is this a precaution for the next step in getting the HDD to actually be assingable?

0

Share this post


Link to post
Share on other sites

ok im confused, apparently ubuntu is linux itself? can i use ubuntu to use ddrescue

0

Share this post


Link to post
Share on other sites

Ubuntu is one (among many) available Linux distributions.

Unlike what happens in the MS world, Linux is Open Source and (largely free as in free beer, besides being free as in freedom).

Basically everyone can "assemble" a Linux distribution (or "distro") which may be "universal" or "very specific" (either in the sense of running only on a given hardware or of being "focused" on a specific subset of computing tasks).

In practice there are only a couple handfuls of "main" distro's, and Ubuntu is one of them.

There are more "flavours" or "spin-offs" or "remixes" of Ubuntu as stars in the sky (plus the infinite number of other distro's), it is very confusing for a new user.

Ubuntu is a "fully featured distro" (please read, though I will be soon flamed for this :ph34r:, as "a nice but senselessly huge amount of of bloatware, a large part of which being bells and whistle") for your uses smaller/simpler distro's will probably be more suited.

You want a "Live CD" distro, i.e. something that is not installed anywhere but that runs directly from a CD or USB stick.

Possible candidates:

http://www.sysresccd.org/SystemRescueCd_Homepage (still largish)

http://puppylinux.org/ (as small as it can be)

http://trinityhome.org/ (what I would probably use if I were you)

This article should be of use:

http://techmuck.blogspot.it/2012/03/data-recovery-with-gnu-ddrescue.html

as well as this thread:

http://www.murga-linux.com/puppy/viewtopic.php?t=71026

I think you will need anyway some assistance from a friend a bit more familiar than you with the Linux environment, as a few "naming" conventions" and commands are different from DOS or more generally Windows command prompt.

There is nothing overly complex in the use of such tools, but there is a concrete risks for the newbie (no offence whatever intended :)) to "confuse" disks/drives/devices, with consequent potentially catastrophic resuts.

In any case ideally you should first try the procedure with another (working) possibly smallish hard disk (or a USB stick), just to get the hang of it.

The mentioned:

http://www.pendrivelinux.com/linux-live-usb-creator/#more-3034

should do if you wish to use a USB stick (instead of "burned" CD), check if the distro you choose is supported by the tool, most are.

About temperatures, the rule of the thumb is that if it's "warm" i.e. you can hold your hand touching it's cover more than a few seconds and feel it "warm" (i.e. it is around 40° Celsius or less) it is fine, if you feel it "like hot" (i.e. it is around 50° Celsius) is still within the norm, if it feels "very hot", it is "very hot" ;) and probably needs some added ventilation/cooling.

The general idea is to copy as much data as possible to a new disk (or disk image).

If you make an image of a perfectly working disk (or a "clone" of the disk on another one) the result will be identical to the source.

When a "failing" or "partially failed" disk is the source the result will be "similar", i.e. it will be identical for corresponding "good sectors" and will have "holes" for the bad ones (actually sectors containing 00's).

The image (or clone) being on a fully working hard disk allows to performa actions that would be impossible to do on the failing/partially failed disk, such as filesystem reconstruction and/or file recovery.

In theory, one should make a second image (from the first one) and attempt recovery on this last one, as this allows to attempt different techniques (including some that while recovering something make something else unrecoverable) as a "way back" is available any time.

But it depends on the amount of data that the ddrescue actually manages to copy and from a number of other factors (if only a small part of the disk is imaged without errors or if anyway "key parts" of the filesystem are still missing there is no sense in attempting filesystem recovery and all you can do is attempt file based recovery which is read only, so this second image is not needed).

jaclaz

0

Share this post


Link to post
Share on other sites

once again thank you, the ubuntu i have, is installed via dual boot running along side windows 7 ultimate 32 bit

ubuntu is:

Ubuntu 13.10
32 bit
can you tell me how to install/download on ubuntu, extremely noob with it, thank you
and i understand now what you mean by imaging the drive now
0

Share this post


Link to post
Share on other sites

once again thank you, the ubuntu i have, is installed via dual boot running along side windows 7 ultimate 32 bit

ubuntu is:

Ubuntu 13.10
32 bit
can you tell me how to install/download on ubuntu, extremely noob with it, thank you
and i understand now what you mean by imaging the drive now

ddrescue is likely already there, or if not, read here:

https://help.ubuntu.com/community/DataRecovery

Sometimes the good :) Linux guys have a peculiar way to make things more complex by misnaning or confusing things by giving to different things the same name, etc. :w00t: or - some other times - by giving so many options to do something that it makes reaching the goal more difficult.

The above page has a link to another page where 5 or 6 different methods to install ddrescue (which is astutely called gddrescue as package, whilst the ddrescue package actually delivers dd_rescue :ph34r:) but the easiest would be to use apt-get as in:

http://www.forensicswiki.org/wiki/Ddrescue

http://www.forensicswiki.org/wiki/Ddrescue#Debian_and_Ubuntu

sudo apt-get install gddrescue

jaclaz

Edited by jaclaz
0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.